<!DOCTYPE html>
<html>

<head>
	<meta charset="utf-8">
	<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1">
	<meta name="theme-color" content="#33474d">
	<title>失落的乐章</title>
	<link rel="stylesheet" href="/css/style.css" />
	
      <link rel="alternate" href="/atom.xml" title="失落的乐章" type="application/atom+xml">
    
</head>

<body>

	<header class="header">
		<nav class="header__nav">
			
				<a href="/archives" class="header__link">Archive</a>
			
				<a href="/tags" class="header__link">Tags</a>
			
				<a href="/atom.xml" class="header__link">RSS</a>
			
		</nav>
		<h1 class="header__title"><a href="/">失落的乐章</a></h1>
		<h2 class="header__subtitle">技术面前，永远都是学生。</h2>
	</header>

	<main>
		
	<span class="different-posts different-posts_earlier">📖 <a href="/page/34">earlier posts</a> 📖</span>




	<article>
	
		<h1><a href="/2017/10/12/LVS/14. LVS调度算法/">LVS调度算法</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS主要的调度算法</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;轮询调度-加权轮询调度-最小连接调度-加权最小连接调度-基于局部性的最少连接-带复制的基于局部性的最少连接-目标地址散列调度-源地址散列调度</p>
<ol>
<li><p>轮询算法(RR)就是按依次循环的方式将请求调度到不同的服务器上，该算法最大的特点就是实现简单。轮询算法假设所有的服务器处理请求的能力都是一样的，调度器会将所有的请求平均分配给每个真实服务器</p>
</li>
<li><p>加权轮询算法(WRR)主要是对轮询算法的一种优化与补充，LVS会考虑每台服务器的性能，并给每台服务器添加一个权值，如果服务器A的权值为1，服务器B的权值为2，则调度到服务器B的请求会是服务器A的两倍。权值越高的服务器，处理的请求越多。</p>
</li>
<li><p>最小连接调度算法(LC)将把请求调度到连续数量最小的服务器上，</p>
</li>
<li><p>加权最小连接算法(WLC)则是给每台服务器一个权值，调度器会尽可能保持服务器连接数量与权值之间的平衡</p>
</li>
<li><p>基于局部性的最少连接调度算法(lblc)是请求数据包的目标IP地址的一种调度算法，该算法先根据请求的目标IP地址寻找最近的该目标IP地址所有使用的服务器，如果这台服务器依然可用，并且用能力处理该请求，调度器会尽量选择相同的服务器，否则会继续选择其他可行的服务器。</p>
</li>
<li><p>带复杂的基于局部性最少的连接算法(lblcr)激励的不是一个目标IP与一台服务器之间的连接记录，他会维护一个目标IP到一组服务器之间的映射关系，防止单点服务器负责过高</p>
</li>
<li><p>目标地址散列调度算法(DH)也是根据目标IP地址通过散列函数将目标IP与服务器建立映射关系，出现服务器不可用或负载过高的情况下，发往该目标IP的请求会固定发给该服务器。</p>
</li>
<li><p>源地址散列调度算法(SH)与目标地址散列调度算法类似，但它是根据源地址散列算法进行静态分配固定的服务器资源</p>
</li>
</ol>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/13. LB 集群之 LVS 介绍/">LB 集群之 LVS 介绍</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LB 集群是 load balance 集群的简写，翻译成中文就是负载均衡集群。常用的负载均衡开源软件有 nginx 、lvs 、keepalived ，商业的硬件负载设备 F5 、Netscale 。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LB 集群的架构如下图，原理也很简单，就是当用户的请求过来时，会直接发到分发器（Director Server）上，然后它把用户的请求根据预先设置好的算法，智能均衡地分发到后端的真正服务器（real server）上。如果不同的机器，可能用户请求到的数据不一样，为了避免这样的情况发生，所以用到了共享存储，这样保证所有用户请求的数据是一样的。</p>
<p><figure class="figure"><img src="" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LVS 是一个实现负载均衡集群的开源软件项目，LVS 架构从罗技上可分为调度层（Director）、server 集群层（real server）和共享存储。 LVS 从实现上分为下面三种模式。</p>
<ol>
<li>NAT （调度器将请求的目标 ip 即 vip 地址改为 real server 的 ip ，返回的数据包也经过调度器，调度器再把源地址修改为 vip）。</li>
</ol>
<p><figure class="figure"><img src="" alt=""></figure></p>
<ol>
<li><p>TUN （调度器将请求来的数据包封装加密通过 ip 隧道转发到后端的 real server 上，而 real server 会直接把数据返回给客户端，而不再经过调度器）。</p>
</li>
<li><p>DR （调度器将请求来的数据包的目标 mac 地址改为 real server 的 mac 地址，返回的时候也不经过调度器，直接返回给客户端）。参考资料<a href="https://hcldirgit.github.io/2017/08/07/9.%20LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%8C%EF%BC%9ALVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%EF%BC%883%E7%A7%8D%E5%B7%A5%E4%BD%9C%E6%96%B9%E5%BC%8F8%E7%A7%8D%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95%EF%BC%89/" target="_blank" rel="external">LVS原理详解及部署之二：LVS原理详解（3种工作方式8种调度算法）</a></p>
</li>
</ol>
<p><figure class="figure"><img src="" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;图中出现的几个 IP 概念，需要解释一下，其中 DIP（driector ip）为分发器的 IP， NAT 模式下它必须为公网 IP ，要对外服务。VIP （virtual ip）为虚拟 IP ，用在 TUN 和 DR 模式中，需要同时配置在分发器和后端真实服务器上。RIP （Resl IP）为后端真实服务器的 IP ，在 TUN 和 DR 模式中，RIP 为公网 IP。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;要想把用户的请求调度给后端的 RS ,是需要经过调度算法来实现的，那么关于 LVS 的调度算法，都有哪些？</p>
<ul>
<li>轮叫调度（Round Robin）（简称 rr），这种算法是最简单的，不管后端 RS 配置和处理能力，非常均衡地分发下去。</li>
<li>加权调度（Weighted Round Robin）（简称 wrr），比上面的算法多了一个权重的概念，可以给 RS 设置权重，权重越高，那么分发的请求越多，权重取值范围 0-100</li>
<li>最少连接（least connection）（LC），这个算法会根据后端 RS 的连接数来决定把请求分给谁，比如 RS1 连接数比 RS2 连接数少，那么请求就优先发给 - 加权最少链接（Weighted Least Connections）（WLC），比第三个算法多了一个权重的概念。</li>
</ul>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;其他算法参考<a href="https://hcldirgit.github.io/2017/08/07/14.%20LVS%E8%B0%83%E5%BA%A6%E7%AE%97%E6%B3%95/" target="_blank" rel="external">LVS调度算法</a></p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/12. LVS原理详解及部署之五：LVS+keepalived实现负载均衡&amp;高可用/">LVS原理详解及部署之五：LVS+keepalived实现负载均衡&amp;高可用</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="一、实验环境需求-amp-准备"><a href="#一、实验环境需求-amp-准备" class="headerlink" title="一、实验环境需求&amp;准备"></a>一、实验环境需求&amp;准备</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这次实验要完成的一个架构如下图所示，通过LVS-DR-MASTER,LVS-DR-BACKUP作为LVS负载均衡调度器，并且两者之间通过keepalived来两者之间的HA。keepalived本身就是为了LVS为开发的，所以说通过keepalived来进行LVS的配置就显得十分的方便。而且keepalived是直接操作ip_vs不用通过ipvsadm，所以更加方便。</p>
<ol>
<li>实验架构图&amp;需求表：</li>
</ol>
<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E5%8E%9F%E7%90%86%E8%AF%A6%E8%A7%A3%E5%8F%8A%E9%83%A8%E7%BD%B2%E4%B9%8B%E4%BA%94%EF%BC%9ALVS+keepalived%E5%AE%9E%E7%8E%B0%E8%B4%9F%E8%BD%BD%E5%9D%87%E8%A1%A1&amp;%E9%AB%98%E5%8F%AF%E7%94%A8/01.jpeg?raw=true" alt=""></figure></p>
<table>
<thead>
<tr>
<th>角色</th>
<th>IP地址</th>
<th>备注</th>
</tr>
</thead>
<tbody>
<tr>
<td>主LVS调度器（MASTER)</td>
<td>192.168.41.181</td>
<td>使用keepalived配置备</td>
</tr>
<tr>
<td>LVS调度器（BACKUP)</td>
<td>192.168.41.25</td>
<td>&#160;</td>
</tr>
<tr>
<td>1HTTP服务器（RS1)</td>
<td>192.168.41.31</td>
<td>apache服务器（一般生产环境需要外网IP地址，这里用内网IP地址替代）</td>
</tr>
<tr>
<td>HTTP服务器（RS2)</td>
<td>192.168.41.33</td>
<td>&#160;</td>
</tr>
<tr>
<td>虚拟IP地址（VIP)</td>
<td>192.168.41.249</td>
<td>虚拟IP地址</td>
</tr>
</tbody>
</table>
<ol>
<li>部署http服务器，验证能正常访问</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这里就是要保证http能正常访问。</p>
<h2 id="二、配置keepalived实现负载均衡-amp-高可用"><a href="#二、配置keepalived实现负载均衡-amp-高可用" class="headerlink" title="二、配置keepalived实现负载均衡&amp;高可用"></a>二、配置keepalived实现负载均衡&amp;高可用</h2><h3 id="安装keepalived软件"><a href="#安装keepalived软件" class="headerlink" title="安装keepalived软件"></a>安装keepalived软件</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">wget http://www.keepalived.org/software/keepalived-1.2.8.tar.gz</div><div class="line">tar -zxf keepalived-1.2.8.tar.gz</div><div class="line"><span class="built_in">cd</span> keepalived-1.2.8</div><div class="line">./configure --prefix=/usr/<span class="built_in">local</span>/keepalived</div><div class="line">make</div><div class="line">make install</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;配置keepalived的自启动&amp;拷贝keepalived的执行程序</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/sbin/keepalived /usr/sbin/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/sbin/keepalived /usr/sbin/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/etc/sysconfig/keepalived /etc/sysconfig/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;开启内核的转发功能</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">vi /etc/sysctl  net.ipv4.ip_forword = 1</div></pre></td></tr></table></figure>
<h3 id="配置LVS-DR-MASK的keepalived-conf配置文件"><a href="#配置LVS-DR-MASK的keepalived-conf配置文件" class="headerlink" title="配置LVS-DR-MASK的keepalived.conf配置文件"></a>配置LVS-DR-MASK的keepalived.conf配置文件</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div><div class="line">48</div></pre></td><td class="code"><pre><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line">global_defs &#123;</div><div class="line"> notification_email &#123;</div><div class="line"> 752119102@qq.com <span class="comment">#设置报警邮箱，一般不再这做，而是用其他方式报警。</span></div><div class="line"> &#125;</div><div class="line"> notification_email_from keepalived@localhost <span class="comment">#设定发送邮件地址</span></div><div class="line"> smtp_server 127.0.0.1 <span class="comment">#设定发送邮件服务器</span></div><div class="line"> smtp_connect_timeout 30 <span class="comment">#设定SMTP连接超时时间</span></div><div class="line"> router_id LVS_DEVEL <span class="comment">#查阅说明文档得知route_id配置是为了标识当前节点，我将其设置为NodeA。当然两个节点的此项设置可相同，也可不相同。</span></div><div class="line">&#125;</div><div class="line">vrrp_instance VI_1 &#123; <span class="comment">#定义虚拟路由实例，不同实例ID不同。</span></div><div class="line"> state MASTER  <span class="comment">#定义服务器在keepalived中的角色主服务器</span></div><div class="line"> interface eth0 <span class="comment">#定义进行检测的端口eth0</span></div><div class="line"> virtual_router_id 51 <span class="comment">#定义虚拟路由ID，同一个实例的主从一样。</span></div><div class="line"> priority 100  <span class="comment">#定义在虚拟路由器组的权限，越大越高</span></div><div class="line"> advert_int 1 <span class="comment">#定义检测时间间隔</span></div><div class="line"> authentication &#123; <span class="comment">#定义认证方式密码，主从必须一样</span></div><div class="line"> auth_type PASS</div><div class="line"> auth_pass 1111</div><div class="line"> &#125;</div><div class="line"> virtual_ipaddress &#123; <span class="comment">#指定虚拟IP地址</span></div><div class="line"> 192.168.41.249</div><div class="line"> &#125;</div><div class="line">&#125;</div><div class="line">virtual_server 192.168.41.249 80 &#123; <span class="comment">#定义虚拟服务，需指定IP地址和端口，空格隔开。</span></div><div class="line"> delay_loop 6  <span class="comment">#定义RS运行情况监测时间间隔</span></div><div class="line"> lb_algo rr  <span class="comment">#定义负载调度算法</span></div><div class="line"> lb_kind DR <span class="comment">#定义LVS的工作模式</span></div><div class="line"> nat_mask 255.255.255.0 <span class="comment">#定义虚拟服务的mask</span></div><div class="line"> persistence_timeout 50 <span class="comment">#定义会话保持时间，S为单位</span></div><div class="line"> protocol TCP <span class="comment">#指定转发协议</span></div><div class="line"> real_server 192.168.41.31 80 &#123; <span class="comment">#定义真实服务器IP地址和端口</span></div><div class="line"> weight 1 <span class="comment">#定义RS的权重</span></div><div class="line"> TCP_CHECK&#123; <span class="comment">#RS server健康检查部分</span></div><div class="line"> connect_timeout 10 <span class="comment">#定义超出10s连接超时</span></div><div class="line"> nb_get_retry 3 <span class="comment">#定义重试次数</span></div><div class="line"> delay_before_retry 3 <span class="comment">#定义重试时间间隔</span></div><div class="line"> connect_port 80 <span class="comment">#定义健康检查端口</span></div><div class="line"> &#125;</div><div class="line"> real_server 192.168.41.33 80 &#123; </div><div class="line"> weight 1</div><div class="line"> TCP_CHECK&#123; </div><div class="line"> connect_timeout 10 </div><div class="line"> nb_get_retry 3 </div><div class="line"> delay_before_retry 3 </div><div class="line"> connect_port 80 </div><div class="line"> &#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<h3 id="配置LVS-DR-BACKUP的keepalived-conf配置文件"><a href="#配置LVS-DR-BACKUP的keepalived-conf配置文件" class="headerlink" title="配置LVS-DR-BACKUP的keepalived.conf配置文件"></a>配置LVS-DR-BACKUP的keepalived.conf配置文件</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div><div class="line">42</div><div class="line">43</div><div class="line">44</div><div class="line">45</div><div class="line">46</div><div class="line">47</div></pre></td><td class="code"><pre><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line">global_defs &#123;</div><div class="line"> notification_email &#123;</div><div class="line"> 752119102@qq.com <span class="comment">#设置报警邮箱，一般不再这做，而是用其他方式报警。</span></div><div class="line"> &#125;</div><div class="line"> notification_email_from keepalived@localhost <span class="comment">#设定发送邮件地址</span></div><div class="line"> smtp_server 127.0.0.1 <span class="comment">#设定发送邮件服务器</span></div><div class="line"> smtp_connect_timeout 30 <span class="comment">#设定SMTP连接超时时间</span></div><div class="line"> router_id LVS_DEVEL  <span class="comment">#负载均衡器标示，在局域网内是唯一的</span></div><div class="line">&#125;</div><div class="line">vrrp_instance VI_1 &#123; <span class="comment">#定义虚拟路由实例，不同实例ID不同。</span></div><div class="line"> state BACKUP  <span class="comment">#定义服务器在keepalived中的角色</span></div><div class="line"> interface eth0 <span class="comment">#定义进行检测的端口eth0</span></div><div class="line"> virtual_router_id 51 <span class="comment">#定义虚拟路由ID，同一个实例的主从一样。</span></div><div class="line"> priority 50  <span class="comment">#定义在虚拟路由器组的权限，越大越高</span></div><div class="line"> advert_int 1 <span class="comment">#定义检测时间间隔</span></div><div class="line"> authentication &#123; <span class="comment">#定义认证方式密码，主从必须一样</span></div><div class="line"> auth_type PASS</div><div class="line"> auth_pass 1111</div><div class="line"> &#125;</div><div class="line"> virtual_ipaddress &#123; <span class="comment">#指定虚拟IP地址</span></div><div class="line"> 192.168.41.249</div><div class="line"> &#125;</div><div class="line">&#125;</div><div class="line">virtual_server 192.168.41.249 80 &#123; <span class="comment">#定义虚拟服务，需指定IP地址和端口，空格隔开。</span></div><div class="line"> delay_loop 6 <span class="comment">#定义RS运行情况监测时间间隔</span></div><div class="line"> lb_algo rr <span class="comment">#定义负载调度算法</span></div><div class="line"> lb_kind DR <span class="comment">#定义LVS的工作模式</span></div><div class="line"> nat_mask 255.255.255.0 <span class="comment">#定义虚拟服务的mask</span></div><div class="line"> persistence_timeout 50 <span class="comment">#定义会话保持时间，S为单位</span></div><div class="line"> protocol TCP <span class="comment">#指定转发协议</span></div><div class="line"> real_server 192.168.41.31 80 &#123; <span class="comment">#定义真实服务器IP地址和端口</span></div><div class="line"> weight 1 <span class="comment">#定义RS的权重</span></div><div class="line"> TCP_CHECK&#123; <span class="comment">#RS server健康检查部分</span></div><div class="line"> connect_timeout 10 <span class="comment">#定义超出10s连接超时</span></div><div class="line"> nb_get_retry 3 <span class="comment">#定义重试次数</span></div><div class="line"> delay_before_retry 3 <span class="comment">#定义重试时间间隔</span></div><div class="line"> connect_port 80 <span class="comment">#定义健康检查端口</span></div><div class="line"> &#125;</div><div class="line"> real_server 192.168.41.33 80 &#123; </div><div class="line"> weight 1</div><div class="line"> TCP_CHECK&#123; </div><div class="line"> connect_timeout 10 </div><div class="line"> nb_get_retry 3 </div><div class="line"> delay_before_retry 3 </div><div class="line"> connect_port 80 </div><div class="line"> &#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;说明：这里主LVS-DR-MASTER和LVS-DR-BACKUP之间的配置的差别就只有红色部分：HA的角色（MASTER,BACKUP)和优先级不同，还有router_id。</p>
<h3 id="客户端配置LVS参数"><a href="#客户端配置LVS参数" class="headerlink" title="客户端配置LVS参数"></a>客户端配置LVS参数</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;客户端需要做的工作就是绑定我们的VIP在lo口，并且进行ARP抑制，之前的文章已经提过此方法咯。现在我们就换成将配置写成脚本来执行。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;脚本内容：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div><div class="line">26</div><div class="line">27</div><div class="line">28</div><div class="line">29</div><div class="line">30</div><div class="line">31</div><div class="line">32</div><div class="line">33</div><div class="line">34</div><div class="line">35</div><div class="line">36</div><div class="line">37</div><div class="line">38</div><div class="line">39</div><div class="line">40</div><div class="line">41</div></pre></td><td class="code"><pre><div class="line">[root@RS2 ~]<span class="comment"># cat lvs-client.sh</span></div><div class="line"><span class="comment">#!/bin/bask</span></div><div class="line"><span class="comment"># 752119102@qq.com</span></div><div class="line"><span class="comment">#</span></div><div class="line">. /etc/rc.d/init.d/<span class="built_in">functions</span></div><div class="line">VIP=(</div><div class="line">192.168.41.249</div><div class="line">)</div><div class="line"><span class="keyword">function</span> <span class="function"><span class="title">start</span></span>()&#123;</div><div class="line"> <span class="keyword">for</span> ((i=0;i&lt;`<span class="built_in">echo</span> <span class="variable">$&#123;#VIP[*]&#125;</span>`;i++))</div><div class="line"> <span class="keyword">do</span></div><div class="line"> <span class="built_in">echo</span> <span class="variable">$&#123;i&#125;</span> <span class="variable">$&#123;VIP[$i]&#125;</span></div><div class="line"> ifconfig lo:<span class="variable">$&#123;i&#125;</span> <span class="variable">$&#123;VIP[$i]&#125;</span> netmask 255.255.255.255 up</div><div class="line"> route add -host <span class="variable">$&#123;VIP[$i]&#125;</span> dev lo</div><div class="line"> <span class="keyword">done</span></div><div class="line"><span class="built_in">echo</span> <span class="string">"1"</span>&gt;/proc/sys/net/ipv4/conf/lo/arp_ignore</div><div class="line"><span class="built_in">echo</span> <span class="string">"2"</span>&gt;/proc/sys/net/ipv4/conf/lo/arp_announce</div><div class="line"><span class="built_in">echo</span> <span class="string">"1"</span>&gt;/proc/sys/net/ipv4/conf/all/arp_announce</div><div class="line"><span class="built_in">echo</span> <span class="string">"2"</span>&gt;/proc/sys/net/ipv4/conf/all/arp_announce</div><div class="line">&#125;</div><div class="line"><span class="keyword">function</span> <span class="function"><span class="title">stop</span></span>()&#123;</div><div class="line"> <span class="keyword">for</span> ((i=0;i&lt;<span class="variable">$&#123;#VIP[*]&#125;</span>;i++))</div><div class="line"> <span class="keyword">do</span></div><div class="line"> <span class="built_in">echo</span> <span class="variable">$&#123;i&#125;</span> <span class="variable">$&#123;VIP[$i]&#125;</span></div><div class="line"> ifconfig lo:<span class="variable">$&#123;i&#125;</span> <span class="variable">$&#123;VIP[$i]&#125;</span> netmask 255.255.255.255 up</div><div class="line"> route del -host <span class="variable">$&#123;VIP[$i]&#125;</span> dev lo:<span class="variable">$&#123;i&#125;</span></div><div class="line"> <span class="keyword">done</span></div><div class="line">&#125;</div><div class="line"><span class="keyword">case</span> <span class="string">"<span class="variable">$1</span>"</span> <span class="keyword">in</span></div><div class="line"> start)</div><div class="line"> start</div><div class="line"> <span class="built_in">exit</span></div><div class="line"> ;;</div><div class="line"> stop)</div><div class="line"> stop</div><div class="line"> <span class="built_in">exit</span></div><div class="line"> ;;</div><div class="line"> *)</div><div class="line"> <span class="built_in">echo</span> <span class="string">"You must use <span class="variable">$0</span>:stop|start"</span></div><div class="line"> ;;</div><div class="line"><span class="keyword">esac</span></div></pre></td></tr></table></figure>
<h3 id="测试实验结果"><a href="#测试实验结果" class="headerlink" title="测试实验结果"></a>测试实验结果</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;如果测试部成功可以按照三角的排查原理来进行排查，显示client到RS端是否能通讯，LB到RS能否通讯，client到LB是否能通讯，client到VIP是否能够通讯。并且查看LVS的运行状态。一定要确保keepalived.conf这个配置文件是正确的。</p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/11. LVS原理详解及部署之四：keepalived介绍/">LVS原理详解及部署之四：keepalived介绍</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="一、keepalived原理介绍"><a href="#一、keepalived原理介绍" class="headerlink" title="一、keepalived原理介绍"></a>一、keepalived原理介绍</h2><h3 id="keepalived简介"><a href="#keepalived简介" class="headerlink" title="keepalived简介"></a>keepalived简介</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Keepalived的功能有点像是两个人互相看着一个工作，如果一个人离开岗位另外一个人就会接替，这个keepalived就是他们之间保持这样“替换机制”的工具。keepalived是一个类似于layer3, 4 &amp; 5交换机制的软件，也就是我们平时说的第3层、第4层和第5层交换。Keepalived的作用是检测web服务器的状态，如果有一台web服务器死机，或工作出现故障，Keepalived将检测到，并将有故障的web服务器从系统中剔除，当web服务器工作正常后Keepalived自动将web服务器加入到服务器群中，这些工作全部自动完成，不需要人工干涉，需要人工做的只是修复故障的web服务器。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Keepalived服务主要有两大用途：heartbeat（高可用）&amp;failover（健康检测）</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Keepalived服务主要截图vrrp来完成这些工作的，以下我就来介绍下VRRP协议是怎样的工作的，那么基本上keepalived的工作原理就是如此。</p>
<h3 id="VRRP协议（VRRP-Virtual-Router-Redundancy-Protocol，虚拟路由冗余协议）"><a href="#VRRP协议（VRRP-Virtual-Router-Redundancy-Protocol，虚拟路由冗余协议）" class="headerlink" title="VRRP协议（VRRP Virtual Router Redundancy Protocol，虚拟路由冗余协议）"></a>VRRP协议（VRRP Virtual Router Redundancy Protocol，虚拟路由冗余协议）</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>VRRP协议过程简述</strong>：VRRP 将局域网的一组路由器（包括一个Master 即活动路由器和若干个Backup 即备份路由器）组织成一个虚拟路由器，称之为一个备份组。这个虚拟的路由器拥有自己的IP 地址10.100.10.1（这个IP 地址可以和备份组内的某个路由器的接口地址相同，相同的则称为ip拥有者），备份组内的路由器也有自己的IP 地址（如Master的IP 地址为10.100.10.2，Backup 的IP 地址为10.100.10.3）。局域网内的主机仅仅知道这个虚拟路由器的IP 地址10.100.10.1，而并不知道具体的Master 路由器的IP 地址10.100.10.2 以及Backup 路由器的IP 地址10.100.10.3。[1]它们将自己的缺省路由下一跳地址设置为该虚拟路由器的IP 地址10.100.10.1。于是，网络内的主机就通过这个虚拟的路由器来与其它网络进行通信。如果备份组内的Master 路由器坏掉，Backup 路由器将会通过选举策略选出一个新的Master 路由器，继续向网络内的主机提供路由服务。从而实现网络内的主机不间断地与外部网络进行通信。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;<strong>VRRP原理</strong>：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;一个VRRP路由器有唯一的标识：VRID，范围为0—255该路由器对外表现为唯一的虚拟MAC地址，地址的格式为00-00-5E-00-01-[VRID]主控路由器负责对ARP请求用该MAC地址做应答这样,无论如何切换，保证给终端设备的是唯一一致的IP和MAC地址，减少了切换对终端设备的影响[3]</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;VRRP控制报文只有一种：VRRP通告(advertisement)它使用IP多播数据包进行封装，组地址为224.0.0.18，发布范围只限于同一局域网内这保证了VRID在不同网络中可以重复使用为了减少网络带宽消耗只有主控路由器才可以周期性的发送VRRP通告报文备份路由器在连续三个通告间隔内收不到VRRP或收到优先级为0的通告后启动新的一轮VRRP选举[3]</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在VRRP路由器组中，按优先级选举主控路由器，VRRP协议中优先级范围是0—255若VRRP路由器的IP地址和虚拟路由器的接口IP地址相同，则称该虚拟路由器作VRRP组中的IP地址所有者；IP地址所有者自动具有最高优先级：255优先级0一般用在IP地址所有者主动放弃主控者角色时使用可配置的优先级范围为1—254优先级的配置原则可以依据链路的速度和成本路由器性能和可靠性以及其它管理策略设定主控路由器的选举中，高优先级的虚拟路由器获胜，因此，如果在VRRP组中有IP地址所有者，则它总是作为主控路由的角色出现对于相同优先级的候选路由器，按照IP地址大小顺序选举VRRP还提供了优先级抢占策略，如果配置了该策略，高优先级的备份路由器便会剥夺当前低优先级的主控路由器而成为新的主控路由器[3]</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;为了保证VRRP协议的安全性，提供了两种安全认证措施：明文认证和IP头认证明文认证方式要求：在加入一个VRRP路由器组时，必须同时提供相同的VRID和明文密码适合于避免在局域网内的配置错误，但不能防止通过网络监听方式获得密码IP头认证的方式提供了更高的安全性，能够防止报文重放和修改等攻击。</p>
<h2 id="二、部署keepalived作为web服务器的HA"><a href="#二、部署keepalived作为web服务器的HA" class="headerlink" title="二、部署keepalived作为web服务器的HA"></a>二、部署keepalived作为web服务器的HA</h2><ol>
<li>部署两台apache web服务器</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">yum install httpd -y </div><div class="line">/etc/init.d/httpd start</div></pre></td></tr></table></figure>
<ol>
<li>分别安装keepalived软件</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;下载安装</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div></pre></td><td class="code"><pre><div class="line">wget http://www.keepalived.org/software/keepalived-1.2.8.tar.gz</div><div class="line">tar -zxf keepalived-1.2.8.tar.gz</div><div class="line"><span class="built_in">cd</span> keepalived-1.2.8</div><div class="line">ll</div><div class="line">./configure --prefix=/usr/<span class="built_in">local</span>/keepalived</div><div class="line">make</div><div class="line">make install</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;配置keepalived的自启动&amp;拷贝keepalived的执行程序</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div></pre></td><td class="code"><pre><div class="line">cp /usr/<span class="built_in">local</span>/keepalive/sbin/keepalived/ /usr/sbin/</div><div class="line">cp cp /usr/<span class="built_in">local</span>/keepalived/sbin/keepalived /usr/sbin//usr/<span class="built_in">local</span>/keepalived/sbin/keepalived</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/sbin/keepalived /usr/sbin/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/etc/sysconfig/keepalived /etc/sysconfig/</div><div class="line">cp /usr/<span class="built_in">local</span>/keepalived/etc/rc.d/init.d/keepalived /etc/init.d/</div></pre></td></tr></table></figure>
<ol>
<li>编辑主web和备web的keepalived配置文件</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;主web服务器的配置文件</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div></pre></td><td class="code"><pre><div class="line">[root@localhost keepalived-1.2.8]<span class="comment"># cat /etc/keepalived.conf </span></div><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line">global_defs &#123;</div><div class="line"> notification_email &#123; <span class="comment">#设置报警邮件地址，可多行每行一个。</span></div><div class="line"> 752119102@qq.com</div><div class="line"> &#125;</div><div class="line"> notification_email_from keepalived@localhost <span class="comment">#设置邮件的发送地址</span></div><div class="line"> smtp_server 127.0.0.1 <span class="comment">#设置SMTP server地址</span></div><div class="line"> smtp_connect_timeout 30 <span class="comment">#设置SMTP 超时时间</span></div><div class="line"> router_id LVS_DEVEL <span class="comment">#运行keepalived机器的一个标识</span></div><div class="line">&#125;</div><div class="line">vrrp_instance VI_1 &#123; <span class="comment">#定义一个vrrp实例，不同实例的实例编号不一样。</span></div><div class="line"> state MASTER <span class="comment">#定义在keepalived的角色MASTER表示为主服务器，BACKUP为备服务器。</span></div><div class="line"> interface eth0 <span class="comment">#指定HA检测的网络接口</span></div><div class="line"> virtual_router_id 51 <span class="comment">#虚拟路由标示，同一个实例里的路由标示相同，且唯一。MASTER和BACKUP的路由标识一样，且唯一。</span></div><div class="line"> priority 100 <span class="comment">#定义此服务器在此虚拟路由器中的优先级，优先级大权限高</span></div><div class="line"> advert_int 1 <span class="comment">#检测时间间隔</span></div><div class="line"> authentication &#123; <span class="comment">#设置验证类型和密码，主从的密码必须相同，要不两者不通讯。</span></div><div class="line"> auth_type PASS</div><div class="line"> auth_pass 1111</div><div class="line"> &#125;</div><div class="line"> virtual_ipaddress &#123; <span class="comment">#设置虚拟IP地址，可以设置多个虚拟IP地址。</span></div><div class="line"> 192.168.41.249</div><div class="line"> &#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;备web服务器的配置文件</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div><div class="line">17</div><div class="line">18</div><div class="line">19</div><div class="line">20</div><div class="line">21</div><div class="line">22</div><div class="line">23</div><div class="line">24</div><div class="line">25</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># cat /etc/keepalived.conf</span></div><div class="line">! Configuration File <span class="keyword">for</span> keepalived</div><div class="line">global_defs &#123;</div><div class="line"> notification_email &#123;</div><div class="line"> 752119102@qq.com</div><div class="line"> &#125;</div><div class="line"> notification_email_from keepalive@localhost</div><div class="line"> smtp_server 127.0.0.1</div><div class="line"> smtp_connect_timeout 30</div><div class="line"> router_id LVS_DEVEL</div><div class="line">&#125;</div><div class="line">vrrp_instance VI_1 &#123;</div><div class="line"> state BACKUP</div><div class="line"> interface eth0</div><div class="line"> virtual_router_id 51</div><div class="line"> priority 50</div><div class="line"> advert_int 1</div><div class="line"> authentication &#123;</div><div class="line"> auth_type PASS</div><div class="line"> auth_pass 1111</div><div class="line"> &#125;</div><div class="line"> virtual_ipaddress &#123;</div><div class="line"> 192.168.41.249</div><div class="line"> &#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;启动keepalived服务</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">/etc/init.d/keepalived start</div><div class="line">/etc/init.d/keepalived stop</div></pre></td></tr></table></figure>
<ol>
<li>查看keepalived日志信息</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;主web服务器</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div><div class="line">16</div></pre></td><td class="code"><pre><div class="line">Jan 14 20:27:41 localhost Keepalived_vrrp[20840]: Opening file <span class="string">'/etc/keepalived/keepalived.conf'</span>.</div><div class="line">Jan 14 20:27:41 localhost Keepalived_vrrp[20840]: Configuration is using : 36304 Bytes</div><div class="line">Jan 14 20:27:41 localhost Keepalived_vrrp[20840]: Using LinkWatch kernel netlink reflector...</div><div class="line">Jan 14 20:27:41 localhost Keepalived[20837]: Starting VRRP child process, pid=20840</div><div class="line">Jan 14 20:27:41 localhost Keepalived_vrrp[20840]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(11,12)]</div><div class="line">Jan 14 20:27:42 localhost Keepalived_vrrp[20840]: VRRP_Instance(VI_1) Transition to MASTER STATE</div><div class="line">Jan 14 20:27:43 localhost Keepalived_vrrp[20840]: VRRP_Instance(VI_1) Entering MASTER STATE</div><div class="line">Jan 14 20:27:43 localhost Keepalived_vrrp[20840]: VRRP_Instance(VI_1) setting protocol VIPs.</div><div class="line">Jan 14 20:27:43 localhost Keepalived_vrrp[20840]: VRRP_Instance(VI_1) Sending gratuitous ARPs on eth0 <span class="keyword">for</span> 192.168.41.249</div><div class="line">Jan 14 20:27:43 localhost Keepalived_vrrp[20840]: Netlink reflector reports IP 192.168.41.249 added</div><div class="line">Jan 14 20:27:43 localhost avahi-daemon[3207]: Registering new address record <span class="keyword">for</span> 192.168.41.249 on eth0.</div><div class="line">Jan 14 20:27:43 localhost Keepalived_healthcheckers[20839]: Netlink reflector reports IP 192.168.41.249 added</div><div class="line">Jan 14 20:27:44 localhost avahi-daemon[3207]: Invalid query packet.</div><div class="line">Jan 14 20:27:46 localhost last message repeated 8 <span class="built_in">times</span></div><div class="line">Jan 14 20:27:48 localhost Keepalived_vrrp[20840]: VRRP_Instance(VI_1) Sending gratuitous ARPs on eth0 <span class="keyword">for</span> 192.168.41.249</div><div class="line">Jan 14 20:27:48 localhost avahi-daemon[3207]: Invalid query packet.</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;备web服务器日志</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">Jan 14 19:55:26 localhost Keepalived_vrrp[19423]: Opening file <span class="string">'/etc/keepalived/keepalived.conf'</span>.</div><div class="line">Jan 14 19:55:26 localhost Keepalived_vrrp[19423]: Configuration is using : 36302 Bytes</div><div class="line">Jan 14 19:55:26 localhost Keepalived_vrrp[19423]: Using LinkWatch kernel netlink reflector...</div><div class="line">Jan 14 19:55:26 localhost Keepalived[19420]: Starting VRRP child process, pid=19423</div><div class="line">Jan 14 19:55:26 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Entering BACKUP STATE</div><div class="line">Jan 14 19:55:26 localhost Keepalived_vrrp[19423]: VRRP sockpool: [ifindex(2), proto(112), unicast(0), fd(11,12)]</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当主web服务器的keepalived停掉后，及主keepalived重新启动时的日志：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div></pre></td><td class="code"><pre><div class="line">Jan 14 20:25:57 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Transition to MASTER STATE</div><div class="line">Jan 14 20:25:58 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Entering MASTER STATE</div><div class="line">Jan 14 20:25:58 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) setting protocol VIPs.</div><div class="line">Jan 14 20:25:58 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Sending gratuitous ARPs on eth0 <span class="keyword">for</span> 192.168.41.249</div><div class="line">Jan 14 20:25:58 localhost Keepalived_vrrp[19423]: Netlink reflector reports IP 192.168.41.249 added</div><div class="line">Jan 14 20:25:58 localhost Keepalived_healthcheckers[19422]: Netlink reflector reports IP 192.168.41.249 added</div><div class="line">Jan 14 20:26:03 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Sending gratuitous ARPs on eth0 <span class="keyword">for</span> 192.168.41.249</div><div class="line"><span class="comment">###主keepalived重新启动后</span></div><div class="line">Jan 14 20:27:42 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Received higher prio advert</div><div class="line">Jan 14 20:27:42 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) Entering BACKUP STATE</div><div class="line">Jan 14 20:27:42 localhost Keepalived_vrrp[19423]: VRRP_Instance(VI_1) removing protocol VIPs.</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;并且通过tcpdump vrrp能够看到两者之间的通讯</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># tcpdump vrrp</span></div><div class="line">tcpdump: verbose output suppressed, use -v or -vv <span class="keyword">for</span> full protocol decode</div><div class="line">listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes</div><div class="line">20:38:58.657600 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div><div class="line">20:38:59.658287 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div><div class="line">20:39:00.659280 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div><div class="line">20:39:01.660358 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div><div class="line">20:39:02.661203 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div><div class="line">20:39:03.662205 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div><div class="line">20:39:04.663129 IP 192.168.41.33 &gt; vrrp.mcast.net: VRRPv2, Advertisement, vrid 51, prio 100, authtype simple, intvl 1s, length 20</div></pre></td></tr></table></figure>
<h2 id="三、脚本实现监控httpd服务"><a href="#三、脚本实现监控httpd服务" class="headerlink" title="三、脚本实现监控httpd服务"></a>三、脚本实现监控httpd服务</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;目前keepalived能够实现当我们的主web宕机或者网络出现故障时进行切换，但如果仅是httpd进程出现故障，所以我们就需要写一点实时监控httpd进程状态的脚本，即如果进程出现问题我们就进行切换。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;脚本内容：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div><div class="line">14</div><div class="line">15</div></pre></td><td class="code"><pre><div class="line"><span class="meta">#!/bin/bash</span></div><div class="line"></div><div class="line"><span class="keyword">while</span> <span class="literal">true</span></div><div class="line"><span class="keyword">do</span></div><div class="line"> httpdpid=`ps -C httpd --no-heading |wc -l`</div><div class="line"> <span class="keyword">if</span> [ <span class="variable">$httpdpid</span> -eq 0 ];<span class="keyword">then</span></div><div class="line"> /etc/init.d/httpd start</div><div class="line"> sleep 5</div><div class="line"> httpdpid=`ps -C httpd --no-heading |wc -l`</div><div class="line"> <span class="keyword">if</span> [ <span class="variable">$httpdpid</span> -eq 0 ];<span class="keyword">then</span></div><div class="line"> /etc/init.d/keepalive stop</div><div class="line"> <span class="keyword">fi</span></div><div class="line"> <span class="keyword">fi</span></div><div class="line"> sleep 5</div><div class="line"><span class="keyword">done</span></div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;即当我们的httpd进程被停止了，并且无法重启我们会将keepalived进行停止，让备web服务器进行接管，成为主WEB服务器提供服务。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;到此我们已经能够轻松的部署keepalived让它作为web服务器的HA.</p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/10. LVS原理详解及部署之三：手动部署LVS/">LVS原理详解及部署之三：手动部署LVS</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<h2 id="一、环境需求-amp-安装LVS软件"><a href="#一、环境需求-amp-安装LVS软件" class="headerlink" title="一、环境需求&amp;安装LVS软件"></a>一、环境需求&amp;安装LVS软件</h2><h3 id="环境准备：三台虚拟机"><a href="#环境准备：三台虚拟机" class="headerlink" title="环境准备：三台虚拟机"></a>环境准备：三台虚拟机</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;此环境是针对内部服务的LVS架构，如数据库，缓存，共享存储等业务。</p>
<table>
<thead>
<tr>
<th>虚拟机角色</th>
<th>IP地址</th>
<th>备注</th>
</tr>
</thead>
<tbody>
<tr>
<td>LVS负载均衡器</td>
<td>192.168.41.181</td>
<td>VIP地址：192.168.40.17</td>
</tr>
<tr>
<td>http服务器</td>
<td>RS1192.168.41.31</td>
<td>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;</td>
</tr>
<tr>
<td>http服务器</td>
<td>RS2192.168.41.33</td>
<td>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;</td>
</tr>
</tbody>
</table>
<h3 id="安装LVS软件"><a href="#安装LVS软件" class="headerlink" title="安装LVS软件"></a>安装LVS软件</h3><ol>
<li><p>在安装LVS软件之前，先确定两条HTTPserver是能够正常访问的。</p>
</li>
<li><p>下载软件</p>
</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">wget http://www.linuxvirtualserver.org/software/kernel-2.6/ipvsadm-1.24.tar.gz</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这里使用的2.4版本，并且注意内核是2.6版本的，如果版本是6.X版本的话，那么可以使用2.6版本</p>
<ol>
<li>编译安装</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;需要创建一个软连接：ln -s /usr/src/kernels/<strong>2.6.18-238.el5-i686</strong> /usr/src/linux</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;此处粗体根据自己的系统来进行定义，可以使用tab键来补齐。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div></pre></td><td class="code"><pre><div class="line">tar -zxf ipvsadm-1.24.tar.gz</div><div class="line"><span class="built_in">cd</span> ipvsadm-1.24</div><div class="line">make</div><div class="line">make install</div><div class="line">lsmod |grep ip_vs</div><div class="line">ipvsadm</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;因为此时系统还没有把ipvs模块加载进系统，需要我们执行ipvsadm命令才会加载进去,或者modprobe ip_vs。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div></pre></td><td class="code"><pre><div class="line">[root@localhost ipvsadm-1.24]<span class="comment"># lsmod |grep ip_vs</span></div><div class="line">ip_vs_rr 6081 1</div><div class="line">ip_vs 78081 3 ip_vs_rr</div></pre></td></tr></table></figure>
<h2 id="二、手动配置LVS负载均衡器"><a href="#二、手动配置LVS负载均衡器" class="headerlink" title="二、手动配置LVS负载均衡器"></a>二、手动配置LVS负载均衡器</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;正常工作中是不会手动配置的，也不会使用脚本配置的。最终我们是通过配置文件生效的，结合keepalived来进行部署的。</p>
<ol>
<li>负载均衡器上配置VIP地址</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">ifconfig eth0:1 192.168.40.17 netmask 255.255.254.0</div><div class="line">route add -host 192.168.40.17  dev eth0</div></pre></td></tr></table></figure>
<ol>
<li>ipvsadm添加LVS服务</li>
</ol>
<table>
<thead>
<tr>
<th>参数</th>
<th>参数说明</th>
</tr>
</thead>
<tbody>
<tr>
<td>-A</td>
<td>-A –add-service 添加一个带选项的虚拟服务。Add a virtual service. A serviceaddress is uniquely defined by a triplet: IP address, portnumber, and protocol. Alternatively a virtualservice may be defined by a firewall-mark.</td>
</tr>
<tr>
<td>-t</td>
<td>指定虚拟服务器的IP地址和端口</td>
</tr>
<tr>
<td>-s</td>
<td>-s,–scheduler scheduling-method 调度算法</td>
</tr>
<tr>
<td>-p</td>
<td>会话保持按秒计算</td>
</tr>
<tr>
<td>-a</td>
<td>-a在对应的VIP下添加RS节点</td>
</tr>
<tr>
<td>-g</td>
<td>指定此LVS的工作模式为-g -g为DR模式</td>
</tr>
<tr>
<td>-l</td>
<td>指定LVS的工作模式为-l -l为tunnel模式</td>
</tr>
<tr>
<td>-m</td>
<td>指定LVS的工作模式为NAT模式</td>
</tr>
<tr>
<td>-w</td>
<td>指定RS节点的权重</td>
</tr>
<tr>
<td>-D</td>
<td>删除虚拟服务.格式：ipvsadm-D -t</td>
<td>u</td>
<td>f service-address. Delete a virtual service, alongwith any associated real servers.</td>
</tr>
<tr>
<td>-C</td>
<td>-C, –clear Clear the virtual server table清空lvs原有的配置。</td>
</tr>
<tr>
<td>-set</td>
<td>设置tcp tcpfn udp 的连接超时时间（一般来说高并发的时候小一点点。</td>
</tr>
</tbody>
</table>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div></pre></td><td class="code"><pre><div class="line">ipvsadm  -C                                                <span class="comment">#请用LVS原有的配置</span></div><div class="line">ipvsadm -A -t 192.168.40.17:80 -s rr -p 20                 <span class="comment">#添加虚拟服务指定VIP</span></div><div class="line">ipvsadm -a -t 192.168.40.17:80 -r 192.168.41.31:80 -g -w 10<span class="comment">#针对虚拟服务添加RS节点</span></div><div class="line">ipvsadm -a -t 192.168.40.17:80 -r 192.168.41.33:80 -g -w 10</div><div class="line">ipvsadm -L -n                                              <span class="comment">#查看VIP和RS是否已经配置成功。</span></div></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div></pre></td><td class="code"><pre><div class="line">[root@localhost ~]<span class="comment"># ipvsadm -L -n</span></div><div class="line">IP Virtual Server version 1.2.1 (size=4096)</div><div class="line">Prot LocalAddress:Port Scheduler Flags</div><div class="line"> -&gt; RemoteAddress:Port Forward Weight ActiveConn InActConn</div><div class="line">TCP 192.168.40.17:80 rr persistent 20</div><div class="line"> -&gt; 192.168.41.33:80 Route 10 0 0 </div><div class="line"> -&gt; 192.168.41.31:80 Route 10 0 0</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;LB上删除虚拟服务</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ipvsadm -D -t 192.168.40.17:80</div></pre></td></tr></table></figure>
<h2 id="三、RS节点服务器手动配置"><a href="#三、RS节点服务器手动配置" class="headerlink" title="三、RS节点服务器手动配置"></a>三、RS节点服务器手动配置</h2><ol>
<li>添加lo端口的VIP&amp;路由</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">ifconfig lo 192.168.40.17 netmask 255.255.255.255</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;(由于RS的VIP不是用来通讯，并且这里一定要设置24位掩码）</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">route add -host 192.168.40.17  dev lo</div></pre></td></tr></table></figure>
<ol>
<li>ARP抑制</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line"><span class="built_in">echo</span> <span class="string">"1"</span>&gt;/proc/sys/net/ipv4/conf/lo/arp_ignore</div><div class="line"><span class="built_in">echo</span> <span class="string">"2"</span>&gt;/proc/sys/net/ipv4/conf/lo/arp_announce </div><div class="line"><span class="built_in">echo</span> <span class="string">"1"</span>&gt;/proc/sys/net/ipv4/conf/all/arp_announce</div><div class="line"><span class="built_in">echo</span> <span class="string">"2"</span>&gt;/proc/sys/net/ipv4/conf/all/arp_announce</div></pre></td></tr></table></figure>
<h2 id="四、测试LVS是否生效"><a href="#四、测试LVS是否生效" class="headerlink" title="四、测试LVS是否生效"></a>四、测试LVS是否生效</h2><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在LB上面输入命令ipvsadm -L -n就能够查看LB上面的会话分配。在前面加上watch可以动态的查看ipvsadm的会话分配。watch ipvsadm -L -n.</p>
<ol>
<li>测试RS节点是否正常访问</li>
<li>测试从LB能否正常访问RS</li>
<li>测试客户端能否正常访问VIP</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在测试的时候可以先把防火墙关闭掉，一般按照这样配置就能够实现LVS的负载均衡了。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;至此我们的LVS DR模式负载均衡已经配置完成了。至于不同的调度算法啊-s  不同的工作模式-g(DR) -l(TUNNEL) -m(NAT)服务器端基本上没有什么差别。只是在客户端上有一定的差别。</p>
<h3 id="NAT模式："><a href="#NAT模式：" class="headerlink" title="NAT模式："></a>NAT模式：</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;客户端同样需要配置VIP，进行ARP抑制，并且要服务器端开启内核转发功能，配置LB的DIP(内网IP地址）作为默认网关。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;开启内核转发功能：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div></pre></td><td class="code"><pre><div class="line">vim /etc/sysctl</div><div class="line"></div><div class="line">net.ipv4.ip_forword = 1</div><div class="line">route add default gw  192.168.41.181</div></pre></td></tr></table></figure>
<h3 id="Tunnel模式："><a href="#Tunnel模式：" class="headerlink" title="Tunnel模式："></a>Tunnel模式：</h3><p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;客户端需要先开启Tunnel协议支持。</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div></pre></td><td class="code"><pre><div class="line">/sbin/modprobe ipip</div><div class="line">/sbin/route add –host 192.168.40.17 devtun1</div><div class="line"><span class="built_in">echo</span>”1”&gt;/proc/sys/net/ipv4/conf/tun1/arp-ignore</div><div class="line"><span class="built_in">echo</span>”2”&gt;/proc/sys/net/ipv4/conf/tun1/arp_announce</div><div class="line"><span class="built_in">echo</span>”0” &gt;/proc/sys/net/ipv4/conf/tun1/rp_filter</div><div class="line"><span class="built_in">echo</span>”1” &gt;/proc/sys/net/ipv4/conf/tun1/forwarding</div><div class="line"><span class="built_in">echo</span>”1” &gt;/proc/sys/net/ipv4/conf/all/arp_ignore</div><div class="line"><span class="built_in">echo</span>”2” &gt;/proc/sys/net/ipv4/conf/all/ arp_announce</div></pre></td></tr></table></figure>
<h2 id="五、部署成功后的另一些问题"><a href="#五、部署成功后的另一些问题" class="headerlink" title="五、部署成功后的另一些问题"></a>五、部署成功后的另一些问题</h2><ol>
<li>当我们的RS节点出现问题，LB如何知道。如果不知道是会把会话连接接续转发到RS上面。</li>
<li>如果LB出现故障，那么整个网络就出现故障。</li>
</ol>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;针对上面的1问题，我们就需要一种RS节点健康检查机制。定时的去检测RS是否正常，如果出现不正常那么就把这个RS从VIP服务里面删除掉。如果恢复正常了，就再把RS添加进来。针对2问题，我们可以另外再架设一台LB服务器，作为备LB服务器。那么当主LB出现故障，备LB服务器就会启动接管主LB服务器的工作，接管它的资源（IP地址，在网络中的角色身份等）</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;而上面提到的这些我们就需要结合keepalived来完成。所以后续我们开始讲keepalived+lvs结合适用。完成RS节点健康检查和LVS的高可用性功能。</p>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/LVS/1. LVS 的 dr 模式/">LVS 的 dr 模式</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/LVS/">LVS</a>
			</span>
		
	</div>

	

	
		<p><figure class="figure"><img src="https://github.com/hcldirgit/image/blob/master/LVS%E7%9A%84dr%E6%A8%A1%E5%BC%8F/01.png?raw=true" alt=""></figure></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;dr模式最稳定，用的最多的时候，当realserver处理完请求以后，直接返回给用户，避免lvs的瓶颈</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;dr模式：调度器将请求来的数据包的目标mac地址改为real server的mac地址，返回的时候也不经过调度器，直接返回给客户端</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;arp广播：地址解析协议，即ARP（Address Resolution Protocol），是根据IP地址获取物理地址的一个TCP/IP协议。主机发送信息时将包含目标IP地址的ARP请求广播到网络上的所有主机，并接收返回消息，以此确定目标的物理地址；收到返回消息后将该IP地址和物理地址存入本机ARP缓存中并保留一定时间，下次请求时直接查询ARP缓存以节约资源。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;先了解arp广播：<strong>根据ip地址找mac地址</strong></p>
<blockquote>
<p>主机A的IP地址为192.168.1.1，MAC地址为0A-11-22-33-44-01；<br>主机B的IP地址为192.168.1.2，MAC地址为0A-11-22-33-44-02；</p>
</blockquote>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;当主机A要与主机B通信时：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;第1步：根据主机A上的路由表内容，IP确定用于访问主机B的转发IP地址是192.168.1.2。然后A主机在自己的本地ARP缓存中检查主机B的匹配MAC地址。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;第2步：如果主机A在ARP缓存中没有找到映射，它将询问192.168.1.2的硬件地址，从而将ARP请求帧广播到本地网络上的所有主机。源主机A的IP地址和MAC地址都包括在ARP请求中。本地网络上的每台主机都接收到ARP请求并且检查是否与自己的IP地址匹配。如果主机发现请求的IP地址与自己的IP地址不匹配，它将丢弃ARP请求。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;第3步：主机B确定ARP请求中的IP地址与自己的IP地址匹配，则将主机A的IP地址和MAC地址映射添加到本地ARP缓存中。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;第4步：主机B将包含其MAC地址的ARP回复消息直接发送回主机A。</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;第5步：当主机A收到从主机B发来的ARP回复消息时，会用主机B的IP和MAC地址映射更新ARP缓存。本机缓存是有生存期的，生存期结束后，将再次重复上面的过程。主机B的MAC地址一旦确定，主机A就能向主机B发送IP通信了。</p>
<p><strong>整个请求过程如下：</strong></p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;client在发起请求之前，会发一个arp广播的包，在网络中找“谁是vip”，由于所有的服务器，lvs和res都有vip，为了让client的请求送到lvs上，所以必须让res不能响应client发出的arp请求，（这也是为什么要禁止res上arp的请求和响应）下面就是lvs转发的事情了：</p>
<ol>
<li>client向目标vip发送请求，lvs接收；此时ip包和数据信息如下：</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">src mac    	dst mac     	src_ip        		dst_ip</div><div class="line">     				192.168.147.1		192.168.147.150</div></pre></td></tr></table></figure>
<ol>
<li>lvs根据负载均衡的算法，选择一台realserver，然后把realserver1的mac地址作为目的mac地址，发送到局域网中</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div></pre></td><td class="code"><pre><div class="line">src mac    	dst mac     	src_ip        			dst_ip 	</div><div class="line">                                192.168.147.1			192.168.147.150</div></pre></td></tr></table></figure>
<ol>
<li>realserver1在局域网中收到这个请求以后，发现目的ip和本地匹配，于是进行处理，处理完成以后，直接把源ip和目的ip直接对调，然后经过网关直接返回给用户；</li>
</ol>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div><div class="line">12</div><div class="line">13</div></pre></td><td class="code"><pre><div class="line">src mac    		dst mac    			 src_ip        			dst_ip 	</div><div class="line">                                                 	192.168.147.150		192.168.147.1</div><div class="line">```    </div><div class="line"></div><div class="line"><span class="comment">## 问题</span></div><div class="line"></div><div class="line">realserver如何抑制arp请求</div><div class="line"></div><div class="line">```bash</div><div class="line"><span class="built_in">echo</span> <span class="string">"1"</span> &gt;/proc/sys/net/ipv4/conf/lo/arp_ignore</div><div class="line"><span class="built_in">echo</span> <span class="string">"2"</span> &gt;/proc/sys/net/ipv4/conf/lo/arp_announce</div><div class="line"><span class="built_in">echo</span> <span class="string">"1"</span> &gt;/proc/sys/net/ipv4/conf/all/arp_ignore</div><div class="line"><span class="built_in">echo</span> <span class="string">"2"</span> &gt;/proc/sys/net/ipv4/conf/all/arp_announce</div></pre></td></tr></table></figure>
	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/Linux安全/9. root账户不能使用密码只能使用密钥远程登陆/">root账户不能使用密码只能使用密钥远程登陆</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/Linux安全/">Linux安全</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;打开sshd配置文件  </p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">vim /etc/ssh/sshd_config</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在最后面增加一行</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">PermitRootLogin without-password</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;保存配置文件后重启sshd服务</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">service sshd restart</div></pre></td></tr></table></figure>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/Linux安全/7. nginx禁止某个IP或者IP段访问站点的设置方法/">nginx禁止某个IP或者IP段访问站点的设置方法</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/Linux安全/">Linux安全</a> <a class="article__tag-link" href="/tags/Nginx/">Nginx</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;首先建立下面的配置文件放在nginx的conf目录下面,命名为deny.ip   </p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">cat deny.ip</div></pre></td></tr></table></figure>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div></pre></td><td class="code"><pre><div class="line">deny 192.168.1.11;</div><div class="line">deny 192.168.1.123;</div><div class="line">deny 10.0.1.0/24;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在nginx的配置文件nginx.conf中加入：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">include deny.ip;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;重启一下nginx的服务：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">/usr/<span class="built_in">local</span>/nginx/sbin/nginx reload</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;就可以生效了。 </p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;deny.ip 的格式中也可以用deny all; </p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;如果你想实现这样的应用，除了几个IP外，其他全部拒绝，</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;那需要你在deny.ip 中这样写</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div></pre></td><td class="code"><pre><div class="line">allow 1.1.1.1; </div><div class="line">allow 1.1.1.2;</div><div class="line">deny all;</div></pre></td></tr></table></figure>

	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/Linux安全/8. nginx限制只让某个ip访问/">nginx限制只让某个ip访问</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/Linux安全/">Linux安全</a> <a class="article__tag-link" href="/tags/Nginx/">Nginx</a>
			</span>
		
	</div>

	

	
		<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div><div class="line">6</div><div class="line">7</div><div class="line">8</div><div class="line">9</div><div class="line">10</div><div class="line">11</div></pre></td><td class="code"><pre><div class="line">server </div><div class="line">&#123;</div><div class="line">    listen 80;</div><div class="line">    server_name www.aldjflas.cn;</div><div class="line">    access_log /home/logs/bbs/access.log combined buffer=32k;</div><div class="line">    error_log /home/logs/bbs/error.log warn;</div><div class="line">    index index.html index.htm index.php;</div><div class="line">    root /data/www/wwwroot/bbs;</div><div class="line">    allow 219.232.244.234;</div><div class="line">    deny all;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
	

	

</article>




	<article>
	
		<h1><a href="/2017/10/12/Linux安全/6. nginx 使用 user_agent 控制客户端访问/">nginx 使用 user_agent 控制客户端访问</a></h1>
	
	<div class="article__infos">
		<span class="article__date">2017-10-12</span><br />
		
		
			<span class="article__tags">
			  	<a class="article__tag-link" href="/tags/Linux安全/">Linux安全</a> <a class="article__tag-link" href="/tags/Nginx/">Nginx</a>
			</span>
		
	</div>

	

	
		<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;nginx的日志格式中，有一个字段叫做 $http_user_agent  这个其实是客户端浏览器的一个信息，比如咱们平时使用IE浏览器的话，nginx的日志中会记录类似于这样的信息：</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div></pre></td><td class="code"><pre><div class="line">Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这一段信息就是 $http_user_agent 了。咱们可以根据这个特点来控制客户端的请求访问。比如，现在有这样一个需求</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;把使用IE 6.0 的客户端禁止访问，我们可以这样做：</p>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;在nignx的配置文件中，加入</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><div class="line">1</div><div class="line">2</div><div class="line">3</div><div class="line">4</div><div class="line">5</div></pre></td><td class="code"><pre><div class="line">location / &#123;</div><div class="line">    <span class="keyword">if</span> (<span class="variable">$http_user_agent</span> ~ <span class="string">'MSIE 6.0'</span>)&#123;</div><div class="line">    <span class="built_in">return</span> 403;</div><div class="line">    &#125;</div><div class="line">&#125;</div></pre></td></tr></table></figure>
<p>&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;这样就能禁止使用IE 6.0的客户端访问服务器。</p>

	

	

</article>





	<span class="different-posts">📖 <a href="/page/36">more posts</a> 📖</span>



	</main>

	<footer class="footer">
	<div class="footer-content">
		
	      <div class="footer__element">
	<p>Hi there, <br />welcome to my Blog glad you found it. Have a look around, will you?</p>
</div>

	    
	      <div class="footer__element">
	<h5>Check out</h5>
	<ul class="footer-links">
		<li class="footer-links__link"><a href="/archives">Archive</a></li>
		
		  <li class="footer-links__link"><a href="/atom.xml">RSS</a></li>
	    
		<li class="footer-links__link"><a href="/about">about page</a></li>
		<li class="footer-links__link"><a href="/tags">Tags</a></li>
		<li class="footer-links__link"><a href="/categories">Categories</a></li>
	</ul>
</div>

	    

		<div class="footer-credit">
			<span>© 2017 失落的乐章 | Powered by <a href="https://hexo.io/">Hexo</a> | Theme <a href="https://github.com/HoverBaum/meilidu-hexo">MeiliDu</a></span>
		</div>

	</div>


</footer>



</body>

</html>
